PHP security flaws alarm Korean government, companies
The website of the PHP Foundation is displayed on a mobile phone in Mierlo, the Netherlands, Wednesday. EPA-Yonhap
Deputy PM urges immediate security updates for firms
The Korean government has issued a nationwide security alert to businesses and website operators over critical vulnerabilities in PHP, a programming language widely used to build websites and web services, as the flaws spark widespread alarm across the globe amid concerns that they could rank among the most severe software vulnerabilities in history.
Experts warned that small and medium-sized enterprises (SMEs) and individual business owners operating websites without dedicated cybersecurity personnel could be particularly vulnerable. They strongly recommended prompt security updates, noting that a vulnerability in one company's website could also affect other businesses whose websites are hosted on the same server.
In a statement released Thursday, the Ministry of Science and ICT urged domestic companies and institutions operating PHP-based websites to immediately apply security updates.
“The latest PHP vulnerabilities could affect a vast number of websites in Korea. An extremely urgent response is required as exploit code is already publicly available," Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon said.
“Conventional preventive measures, such as manual inspections followed by security patches several days later, cannot defend against attacks. Automated response systems are essential, including immediately blocking vulnerable internet-facing assets and proactively applying web application firewall rules.”
Popular website-building tools, such as WordPress and Gnuboard, are based on PHP. Many websites, including those of major government agencies, online stores and news outlets, are also built using the language.
The warning came after critical vulnerabilities, dubbed PHP2Shell, were found, driving government agencies and companies around the world to shut down websites.
The flaws were discovered by cybersecurity researchers, including Google-affiliated Wiz and Calif, which used OpenAI's GPT-5.6 Sol. They stem from how PHP handles memory, potentially allowing hackers to take control of servers or steal sensitive information without authentication.
The flaws received scores of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the highest severity category, known as "critical." European cybersecurity authorities have also classified the vulnerabilities as "critical" and urged immediate security updates. They recommended temporarily disconnecting affected systems from the internet or suspending their operations if updates cannot be applied immediately.
LAN network cables plugged into a computer server, Wednesday. Reuters-Yonhap
As the issue becomes a global security threat, the Korea Internet & Security Agency (KISA), the country's cybersecurity authority, issued an advisory around 11 p.m. Wednesday, saying the PHP development team had released security updates to address the vulnerabilities.
KISA warned that four PHP versions — 8.2, 8.3, 8.4 and 8.5 — could be affected and urged users to install the latest security updates for their respective versions. It also strongly recommended upgrading from PHP 8.1 or earlier versions, which are no longer supported with security updates.
According to cybersecurity firm AhnLab, Korea had an estimated 110,000 hosts (servers) running vulnerable versions of PHP before the security patches were released, the sixth-highest number in the world.
Unlike other vulnerabilities, the latest flaws affect PHP itself, meaning even websites built with secure code could be vulnerable, the ICT ministry said.
Major IT companies in Korea are also issuing internal emergency alerts and intensifying their security measures. In an internal notice Thursday, one of Korea’s largest communications technology firms warned that the PHP flaws could allow external attackers to execute arbitrary commands and called for security patches to be applied to all publicly accessible PHP-based web services within 24 hours.
Experts said the vulnerabilities could expose websites to attacks even if they were built with strong security measures in place. Smaller businesses may face greater difficulties in responding because they often lack dedicated cybersecurity personnel and resources, leaving websites running on outdated PHP versions.
“As the patches are already available, what’s important now is having companies quickly identify which services are running vulnerable versions of PHP and apply the patches,” ENKI WhiteHat CEO Lee Sung-kwon told The Korea Times. “Smaller companies and online shopping malls run by individuals often don't have dedicated security personnel to handle such tasks."
The PHP flaws are drawing the industry’s attention, particularly because the risks may extend beyond individual websites if multiple businesses share the same compromised hosting server.
"If a company operates a PHP server that hosts multiple businesses, all of them could be affected," Lee said. "If information from multiple customers is stored on the same server, the impact could spread to those customers as well."
The science ministry said SMEs and others operating websites through hosting providers should check with their providers to confirm whether security updates have been applied. Domestic hosting companies said they are applying security patches, but cautioned that it is difficult to determine whether all websites are protected because customers use different PHP versions and security configurations.